8787 matches found
CVE-2024-6533 Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options
Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with...
Directus cross-site scripting vulnerabilities
Directus is a real-time Api and application dashboard from Directus Open Source. It is used to manage Sql database content. A cross-site scripting vulnerability exists in Directus version 10.13.0 that originates from allowing an authenticated external attacker to execute arbitrary JavaScript on t...
PT-2024-37695 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus version 10.13.0 Description: The issue allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter into an unsanitized DOM...
CVE-2024-43368: Improper Neutralization of Input During Web Page Generation
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for GHSA-qjqp-xr96-cj99. In pull request 1149, sanitation was added for Trix attachments with a text/html content type. However, Trix only checks the...
Trix security vulnerabilities
Trix is a Basecamp open source rich text editor for everyday writing. A security vulnerability exists in versions prior to Trix 2.1.4 that stems from the presence of cross-site scripting, which allows an attacker to trick a user into copying and pasting malicious code, and then executing arbitrar...
Improper Input Validation
Apache DolphinScheduler is vulnerable to Improper Input Validation. The vulnerability is due to improper input validation allowing an authenticated user to execute arbitrary, unsandboxed JavaScript on the server...
Zimbra Collaboration Server security vulnerabilities
Zimbra Collaboration Server ZCS is an email and collaboration solution from Zimbra. The solution provides email, contacts, calendar, file sharing, social networking, and other features. A security vulnerability exists in Zimbra Collaboration Server versions 9.0 and 10.0, which stems from the...
CVE-2024-33533
An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting XSS vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an...
Zimbra Collaboration Server security vulnerabilities
Zimbra Collaboration Server ZCS is an email and collaboration solution from Zimbra. The solution provides email, contacts, calendar, file sharing, social networking, and other features. A security vulnerability exists in Zimbra Collaboration Server versions 9.0 and 10.0 that stems from the presen...
CVE-2024-27443
An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...
CVE-2024-29831 Apache DolphinScheduler: RCE by arbitrary js execution
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2...
CVE-2024-29831
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2...
Mozilla Firefox for iOS Security Bypass Vulnerability (CNVD-2024-36715)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox for iOS, which can be exploited by attackers to execute Javascript commands in the browser...
CVE-2024-6706 Open WebUI Stored Cross-Site Scripting
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page...
CVE-2024-6706 Open WebUI Stored Cross-Site Scripting
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page...
mshtml.dll Heap Buffer Overflow RCE
The vulnerability of the CDwnBindInfo function in the mshtml.dll library of the Internet Explorer browser is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary JavaScript code by sending a specially created HTML file...
PT-2024-37933 · Journyx · Journyx
Name of the Vulnerable Software and Affected Versions: Journyx affected versions not specified Description: The issue allows attackers to craft a malicious link that, when clicked, will execute arbitrary JavaScript in the context of the Journyx web application. Recommendations: At the moment, the...
CVE-2024-6706: Improper Neutralization of Input During Web Page Generation
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page...
PT-2024-37813
Name of the Vulnerable Software and Affected Versions Open WebUI version 0.1.105 Description The issue allows attackers to craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page. This enables attackers to inject malicious script...